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Remarks 

Claims 1-2, 8, 10, 12, 14, 18, 22-23, 26, 29, 31, and 37 
were rejected as anticipated by SMITHSON et al . 6, 886, 099. 
Claims 1, 22-23, 26, and 29-31 have been amended and reconsideration 
and withdrawal of the rejection are respectfully requested. 

SMITHSON et al . disclose a system with a firewall server 16, 
file server 12, mail server 18, or client computer 14 in a local 
area network 2, which is configured to detect in the first sub- 
system unknown malicious software having a characteristic. The 
system monitors one or more predefined parameters that the system 
already knows and detects an unknown virus by controlling one of 
the predefined parameters that is known in advance. If the 
computer system notices that the predefined parameter exceeds a 
predetermined threshold value, the system determines that the 
virus exists (column 4, lines 5-46) . By contrast to the claims 
herein, the SMITHSON et al. system does not carry out a 
simulation in order to activate an unknown virus in the system to 
cause virus-induced consequences in the system. 

That is, the sub-system defined in the amended claims herein 
detects the activated unknown software, which the sub-system has 
awoken itself, by detecting the consequences of the activation, 
while in SMITHSON et al . the system merely monitors the 
predefined parameters; there is no simulation. 

More specifically, the SMITHSON et al. security system does 
not have a first sub-system configured to detect in the first 
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sub-system an unknown malicious software having a characteristic 
unknown to the first sub-system , where the first sub-system is 
also configured to perform a partial simulation in the first sub- 
system for activating the unknown malicious software having the 
characteristic unknown to the first sub-system for causing a 
consequence of an activation of the unknown malicious software in 
the first sub-system and thereafter to detect the activated 
unknown malicious software in the first sub-system by detecting 
the consequence of the activation of the unknown malicious 
software in the first sub-system . 

Accordingly, the amended claims avoid the rejection under 

§102 . 

Claims 3-6, 9, 15-17, 19-21, 30, 33-34, and 40-41 were 
rejected as unpatentable over SMITHSON et al. in view of CHEFALAS 
et al. 2002/0116639. The independent claims have been amended 
and reconsideration and withdrawal of the rejection of these 
dependent claims are respectfully requested for the reasons given 
above . 

The double listing of the amendments to the claims in the 
present amendment is believed to be responsive to the Notice of 
Non-Compliant Amendment, as best understood. 

In view of the present amendment and the foregoing remarks, 
it is believed that the present application has been placed in 
condition for allowance. Reconsideration and allowance are 
respectfully requested. 
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The Commissioner is hereby authorized in this, concurrent, 
and future replies, to charge payment or credit any overpayment 
to Deposit Account No. 25-0120 for any additional fees required 
under 37 C.F.R. § 1.16 or under 37 C.F.R. § 1.17. 

Respectfully submitted, 

YOUNG & THOMPSON 



/Thomas W. Perkins/ 

Thomas W. Perkins, Reg. No. 33,027 
209 Madison Street, Suite 500 
Alexandria, VA 22314 
Telephone (703) 521-2297 
Telefax (703) 685-0573 
(703) 979-4709 

TWP/abs 
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